RE: New Worm Named W32/Minda.a@mm
From: owentoby@WellsFargo.COMDate: 09/19/01
- Previous message: Jake Frost: "Outloook Security Setting"
- Maybe in reply to: Marc Fossi: "New Worm Named W32/Minda.a@mm"
- Next in thread: TG: "Front Page Extensions Security Issues"
- Reply: TG: "Front Page Extensions Security Issues"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: owentoby@WellsFargo.COM Message-ID: <BFCC17728801D311A6A90001FA7EA1360B60B426@xcem-aztem-04.wellsfargo.com> To: secmail@dirk.demon.co.uk, ScottM@cybear.com, mfossi@securityfocus.com, focus-ms@securityfocus.com Subject: RE: New Worm Named W32/Minda.a@mm Date: Wed, 19 Sep 2001 09:34:44 -0700
Be careful about deleting the admin.dll. There is a legitimate one loaded
by Front Page Server Extensions (why anyone would leave those on a
production server is beyond me, but that's another discussion). Compare
file dates and sizes with known good copies of this file, before you whack a
file needed by your webserver!
Toby
-----Original Message-----
From: Ian Macdonald [mailto:secmail@dirk.demon.co.uk]
Sent: Tuesday, September 18, 2001 2:45 PM
To: Scott Muelhberger; 'Marc Fossi'; Focus-MS
Subject: Re: New Worm Named W32/Minda.a@mm
Current thoughts here are
Delete All *.eml which has todays date
shutdown Web publishing services, and IIS Admin services
delete all admin.dll
install the IIS security rollup patch
reboot
delete the mmc.exe that is 56K in size
You can't delete mmc.exe while it is running, kill.exe from the NT resource
kit will not kill the executable so you need to reboot.
These steps seem to stop the attacks from being generated. I have also seen
alot of tftp files being generated, these should be deleted as well. This is
not the complete answer but it might stop the server from attacking
Ian
----- Original Message -----
From: "Scott Muelhberger" <ScottM@cybear.com>
To: "'Marc Fossi'" <mfossi@securityfocus.com>; "Focus-MS"
<focus-ms@securityfocus.com>
Sent: Tuesday, September 18, 2001 1:12 PM
Subject: RE: New Worm Named W32/Minda.a@mm
> Anyone know how to clean this virus permanently off of servers?
>
> Thank You,
>
> Scott
>
>
>
> -----Original Message-----
> From: Marc Fossi [mailto:mfossi@securityfocus.com]
> Sent: Tuesday, September 18, 2001 12:01 PM
> To: Focus-MS
> Subject: New Worm Named W32/Minda.a@mm
>
> W32/Minda.a@mm is the working name for it.
>
> Marc Fossi, MCSE
> SecurityFocus
> www.securityfocus.com
>
>
>
- Previous message: Jake Frost: "Outloook Security Setting"
- Maybe in reply to: Marc Fossi: "New Worm Named W32/Minda.a@mm"
- Next in thread: TG: "Front Page Extensions Security Issues"
- Reply: TG: "Front Page Extensions Security Issues"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
